Preparing data - Normal mode

 

Only 'not locked' dialog users: will include all users which are not locked out of the system and have an active validity (based on the account's validity at the moment when the download has occurred).

 

All selected users: will include all users which have been locked out of the system (except those users which do not have an active validity at 'download-time).

 

Exclude all users without profiles (reference users will be loaded instead): checking this option will exclude all users who do not have (at least) 1 profile assigned to them form the prepare-process. This option is particularly useful in situations where a large amounts of users exist with limited access to your SAP system, who are linked to a Reference user instead of a profile.

 

Note: When activating this checkbox, a warning may appear in some reports (for example 'excluded users'-report). This is implemented in order to help you remember that a (potentially large) number of users was filtered out before the preparation process and this needs to be mentioned in the Audit results for consistency purposes.

 

Only roles, profiles and authorizations in selected userid's: will include only those roles, profiles and authorizations belonging to the selected users.

 

All roles, profiles and authorizations: will also include roles, profiles and authorizations linked to users who are deselected.

3a) Authorization Objects

 

All authorization objects: will include all authorization objects.

 

Select authorization objects: allows you to restrict the objects that will be taken into account during preparation, based on the queries you will select prior to using this option. This functionality is particularly useful in performance terms in case you are working with large download files.

 

First select the queries you wish to run before you prepare the selection criteria by executing the following steps:

- At the start-up screen choose Audit Cockpit or Select & Run.

Note: In this example we selected all F* (finance) queries.

- Select the queries you want to be using by activating the selection box for each query you want to include. When finished selecting all queries click on the 'back'-button which will save the query-selection and take you back to the start-up screen.

- Click on 'Prepare data' which will take you back to the 'Prepare/Delete redundant data'-panel.

- Click on the 'Selected Authorization Objects'-button which will activate a wizard

 

- Click the 'Paste automatically the selected Authorization Objects of the selected queries'-button which will populate the list of authorization objects which are to be used (the CSI AA automatically includes all objects which are required to run the queries we selected in the previous steps).

-All objects starting with F (finance) are now included for preparation.

 

Note: The queries you didn't select may not run since the authorizations are not loaded, you will get an error message whenever this happens.

 

3b) Authorizations

 

All authorizations: will include all Authorizations.

 

Alternately, using the Exclude Authorizations option, you are able to define which authorizations you do not wish to include in the preparation.
For example, if you are not interested in the 'display authorizations (value 03) you might pre-exclude them using the indicated
'Excluded Authorizations'-button.

 

After indicating which authorizations you wish to exclude simply press the 'back'-button.

 

3c) Grouped Users

 

You can group users when there are several users linked to the same profile. This might be particularly useful when dealing with a large number of ESS-users(employee self service users). Typically you will have several thousands of users in your system with the same role assignments, in this case your CSI Reporting will want one ID to represent all those users.

 

Tip: Using this feature will result in a huge performance gain and improved overview at the reporting stage in cases where a vast amount of users exist with identical functionality).

 

1. Type in a description of the users ID will represent.
2. Type in how the user ID will show up in CSI Reporting.
3. Select a SAP USER ID that represents an example of the grouped ID you wish to create.
4. Click 'Paste Profiles' and the profiles for this group will automatically be pasted in the list.
5. Click 'Show # users' and the number of users which are represented by this ID will automatically be shown. In the CSI Reports the ID will be indicated in this case as SUPER_3. This allows us to know that this ID represents 3 users in the system.
   

 

3d) Excluded Profiles

 

You can exclude user profiles. This might come in handy when you want to exclude super profiles which are only assigned for a limited time period (for instance temporary accounts intended for problem fixing). Using this feature will completely single out the profile in the audit, for ALL users who have this profile assigned to them.  

 

For a detailed description on how to use the Expert mode please see the Expert mode topic.

 

The language used for reporting purposes, this option will affect all descriptions for Profiles, Authorizations and Authorization Objects will be presented in the language of your selection.

 

This is a fixed value (not editable) and is the exact date on which the download of the SAP data has been executed (by means of the CSI Data Translator). 

 

A sleeping account relates to a user who has not logged on since a specific date. By default, the date has been calculated as the run date minus 4 months (120 days) but you are able to change this setting to fit your needs. Sleeping users have user status S.

Dummy Logical System

Selecting dummy logical systems to be populated for queries run: this is used when reviewing multiple systems for SOD reviews, such as BW, CRM, other R3 system etc…
 

Note: There are some restrictions in the CSI AA regarding to the Used Logical System & Dummy Logical System naming.
Once you have used a certain Dummy Logical System name for a Used Logical System, you should continue to use this Dummy-name in conjunction with this Used-system. 
A certain Dummy-name can be used for various Used Logical Systems.
These restrictions are checked as of the moment a Result Container is attached (since the CSI AA will retrieve the naming history from the RC).